Software products (applications) are highly vulnerable to unauthorized copying and use (piracy). Illegally copied applications are commonly distributed on a wide-scale basis over the Internet and via recordable CD-ROMs. Software developers lose billions of dollars per year as a result of such unauthorized copying and distribution.
Software developers commonly use a variety of methods to prevent others from illegally copying and using their products. According to one common method, a software developer distributes a digital license certificate to an authorized user. The digital license certificate contains the terms of use of the software application, such as which user and on which computer the software is authorized for use. When a user attempts to use the application, copy-protection code in the application checks the license certificate to be sure the current use falls under the license terms, and that the license certificate was authentically issued by the software developer. If the copy-protection code finds no license certificate, or a forged license certificate on the user's computer, the application crashes or other wise fails to operate properly. License certificate copy-protection schemes often make use of a cryptographic digital signature algorithm. U.S. Pat. No. 6,078,909 to Knutson (2000) describes such a software licensing system that uses a digital signature algorithm.
However, even applications that use such a licensing system are very vulnerable to attack. Since a computer software application is simply a listing of data bits, ultimately, one cannot prevent attackers from making copies and making arbitrary changes. As well, there is no way to prevent attackers from monitoring the computer software as it executes.
A common defense against tampering is obfuscation. U.S. Pat. No. 6,842,862 to Chow, et al. (2005) describes a method of making software tamper-resistant by obfuscating the executable code. U.S. Pat. No. 6,643,775 to Granger, et al. (2003) also describes a method of making software tamper-resistant by obfuscating executable code.
However, strategies based on obfuscating code suffer the following disadvantages:
(a) Obfuscating code fails to protect embedded data from tampering. As will be shown in a later example, it is often possible to defeat copy protection schemes by modifying only embedded data, without understanding or modifying any executable code.
(b) It is difficult to obfuscate code well. It usually requires using a specially designed compiler or tool to obfuscate the code.
(c) Obfuscating code provides only weak tamper resistance. If an attacker modifies a small portion of obfuscated code in an application, the rest of the code in the application will still execute correctly.
(d) Obfuscating code usually results in a performance degradation of the application. The obfuscated code contains many more instructions than the original code. Therefore, the processor must take more time and consume more power to execute the obfuscated code than to execute the original code.